gcp.compute.FirewallPolicyWithRules

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const addressGroup1 = new gcp.networksecurity.AddressGroup("address_group_1", {
    name: "tf-address-group",
    parent: "organizations/123456789",
    description: "Global address group",
    location: "global",
    items: ["208.80.154.224/32"],
    type: "IPV4",
    capacity: 100,
});
const securityProfile1 = new gcp.networksecurity.SecurityProfile("security_profile_1", {
    name: "tf-security-profile",
    type: "THREAT_PREVENTION",
    parent: "organizations/123456789",
    location: "global",
});
const securityProfileGroup1 = new gcp.networksecurity.SecurityProfileGroup("security_profile_group_1", {
    name: "tf-security-profile-group",
    parent: "organizations/123456789",
    description: "my description",
    threatPreventionProfile: securityProfile1.id,
});
const firewall_policy_with_rules = new gcp.compute.FirewallPolicyWithRules("firewall-policy-with-rules", {
    shortName: "tf-fw-org-policy-with-rules",
    description: "Terraform test",
    parent: "organizations/123456789",
    rules: [
        {
            description: "tcp rule",
            priority: 1000,
            enableLogging: true,
            action: "allow",
            direction: "EGRESS",
            match: {
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: [
                        "8080",
                        "7070",
                    ],
                }],
                destIpRanges: ["11.100.0.1/32"],
                destFqdns: [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                destRegionCodes: [
                    "HK",
                    "IN",
                ],
                destThreatIntelligences: [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                destAddressGroups: [addressGroup1.id],
            },
            targetResources: [project.then(project => `https://www.googleapis.com/compute/beta/projects/${project.name}/global/networks/default`)],
        },
        {
            description: "udp rule",
            priority: 2000,
            enableLogging: false,
            action: "deny",
            direction: "INGRESS",
            match: {
                layer4Configs: [{
                    ipProtocol: "udp",
                }],
                srcIpRanges: ["0.0.0.0/0"],
                srcFqdns: [
                    "www.abc.com",
                    "www.def.com",
                ],
                srcRegionCodes: [
                    "US",
                    "CA",
                ],
                srcThreatIntelligences: [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                srcAddressGroups: [addressGroup1.id],
            },
            disabled: true,
        },
        {
            description: "security profile group rule",
            ruleName: "tcp rule",
            priority: 3000,
            enableLogging: false,
            action: "apply_security_profile_group",
            direction: "INGRESS",
            match: {
                layer4Configs: [{
                    ipProtocol: "tcp",
                }],
                srcIpRanges: ["0.0.0.0/0"],
            },
            targetServiceAccounts: ["test@google.com"],
            securityProfileGroup: pulumi.interpolate`//networksecurity.googleapis.com/${securityProfileGroup1.id}`,
            tlsInspect: true,
        },
    ],
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
address_group1 = gcp.networksecurity.AddressGroup("address_group_1",
    name="tf-address-group",
    parent="organizations/123456789",
    description="Global address group",
    location="global",
    items=["208.80.154.224/32"],
    type="IPV4",
    capacity=100)
security_profile1 = gcp.networksecurity.SecurityProfile("security_profile_1",
    name="tf-security-profile",
    type="THREAT_PREVENTION",
    parent="organizations/123456789",
    location="global")
security_profile_group1 = gcp.networksecurity.SecurityProfileGroup("security_profile_group_1",
    name="tf-security-profile-group",
    parent="organizations/123456789",
    description="my description",
    threat_prevention_profile=security_profile1.id)
firewall_policy_with_rules = gcp.compute.FirewallPolicyWithRules("firewall-policy-with-rules",
    short_name="tf-fw-org-policy-with-rules",
    description="Terraform test",
    parent="organizations/123456789",
    rules=[
        {
            "description": "tcp rule",
            "priority": 1000,
            "enable_logging": True,
            "action": "allow",
            "direction": "EGRESS",
            "match": {
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": [
                        "8080",
                        "7070",
                    ],
                }],
                "dest_ip_ranges": ["11.100.0.1/32"],
                "dest_fqdns": [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                "dest_region_codes": [
                    "HK",
                    "IN",
                ],
                "dest_threat_intelligences": [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                "dest_address_groups": [address_group1.id],
            },
            "target_resources": [f"https://www.googleapis.com/compute/beta/projects/{project.name}/global/networks/default"],
        },
        {
            "description": "udp rule",
            "priority": 2000,
            "enable_logging": False,
            "action": "deny",
            "direction": "INGRESS",
            "match": {
                "layer4_configs": [{
                    "ip_protocol": "udp",
                }],
                "src_ip_ranges": ["0.0.0.0/0"],
                "src_fqdns": [
                    "www.abc.com",
                    "www.def.com",
                ],
                "src_region_codes": [
                    "US",
                    "CA",
                ],
                "src_threat_intelligences": [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                "src_address_groups": [address_group1.id],
            },
            "disabled": True,
        },
        {
            "description": "security profile group rule",
            "rule_name": "tcp rule",
            "priority": 3000,
            "enable_logging": False,
            "action": "apply_security_profile_group",
            "direction": "INGRESS",
            "match": {
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                }],
                "src_ip_ranges": ["0.0.0.0/0"],
            },
            "target_service_accounts": ["test@google.com"],
            "security_profile_group": security_profile_group1.id.apply(lambda id: f"//networksecurity.googleapis.com/{id}"),
            "tls_inspect": True,
        },
    ])

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networksecurity"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		addressGroup1, err := networksecurity.NewAddressGroup(ctx, "address_group_1", &networksecurity.AddressGroupArgs{
			Name:        pulumi.String("tf-address-group"),
			Parent:      pulumi.String("organizations/123456789"),
			Description: pulumi.String("Global address group"),
			Location:    pulumi.String("global"),
			Items: pulumi.StringArray{
				pulumi.String("208.80.154.224/32"),
			},
			Type:     pulumi.String("IPV4"),
			Capacity: pulumi.Int(100),
		})
		if err != nil {
			return err
		}
		securityProfile1, err := networksecurity.NewSecurityProfile(ctx, "security_profile_1", &networksecurity.SecurityProfileArgs{
			Name:     pulumi.String("tf-security-profile"),
			Type:     pulumi.String("THREAT_PREVENTION"),
			Parent:   pulumi.String("organizations/123456789"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		securityProfileGroup1, err := networksecurity.NewSecurityProfileGroup(ctx, "security_profile_group_1", &networksecurity.SecurityProfileGroupArgs{
			Name:                    pulumi.String("tf-security-profile-group"),
			Parent:                  pulumi.String("organizations/123456789"),
			Description:             pulumi.String("my description"),
			ThreatPreventionProfile: securityProfile1.ID(),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewFirewallPolicyWithRules(ctx, "firewall-policy-with-rules", &compute.FirewallPolicyWithRulesArgs{
			ShortName:   pulumi.String("tf-fw-org-policy-with-rules"),
			Description: pulumi.String("Terraform test"),
			Parent:      pulumi.String("organizations/123456789"),
			Rules: compute.FirewallPolicyWithRulesRuleArray{
				&compute.FirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("tcp rule"),
					Priority:      pulumi.Int(1000),
					EnableLogging: pulumi.Bool(true),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("EGRESS"),
					Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
						Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
									pulumi.String("7070"),
								},
							},
						},
						DestIpRanges: pulumi.StringArray{
							pulumi.String("11.100.0.1/32"),
						},
						DestFqdns: pulumi.StringArray{
							pulumi.String("www.yyy.com"),
							pulumi.String("www.zzz.com"),
						},
						DestRegionCodes: pulumi.StringArray{
							pulumi.String("HK"),
							pulumi.String("IN"),
						},
						DestThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-search-engines-crawlers"),
							pulumi.String("iplist-tor-exit-nodes"),
						},
						DestAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
					},
					TargetResources: pulumi.StringArray{
						pulumi.Sprintf("https://www.googleapis.com/compute/beta/projects/%v/global/networks/default", project.Name),
					},
				},
				&compute.FirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("udp rule"),
					Priority:      pulumi.Int(2000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("deny"),
					Direction:     pulumi.String("INGRESS"),
					Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
						Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("udp"),
							},
						},
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						SrcFqdns: pulumi.StringArray{
							pulumi.String("www.abc.com"),
							pulumi.String("www.def.com"),
						},
						SrcRegionCodes: pulumi.StringArray{
							pulumi.String("US"),
							pulumi.String("CA"),
						},
						SrcThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-known-malicious-ips"),
							pulumi.String("iplist-public-clouds"),
						},
						SrcAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
					},
					Disabled: pulumi.Bool(true),
				},
				&compute.FirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("security profile group rule"),
					RuleName:      pulumi.String("tcp rule"),
					Priority:      pulumi.Int(3000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("apply_security_profile_group"),
					Direction:     pulumi.String("INGRESS"),
					Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
						Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
							},
						},
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
					},
					TargetServiceAccounts: pulumi.StringArray{
						pulumi.String("test@google.com"),
					},
					SecurityProfileGroup: securityProfileGroup1.ID().ApplyT(func(id string) (string, error) {
						return fmt.Sprintf("//networksecurity.googleapis.com/%v", id), nil
					}).(pulumi.StringOutput),
					TlsInspect: pulumi.Bool(true),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var addressGroup1 = new Gcp.NetworkSecurity.AddressGroup("address_group_1", new()
    {
        Name = "tf-address-group",
        Parent = "organizations/123456789",
        Description = "Global address group",
        Location = "global",
        Items = new[]
        {
            "208.80.154.224/32",
        },
        Type = "IPV4",
        Capacity = 100,
    });

    var securityProfile1 = new Gcp.NetworkSecurity.SecurityProfile("security_profile_1", new()
    {
        Name = "tf-security-profile",
        Type = "THREAT_PREVENTION",
        Parent = "organizations/123456789",
        Location = "global",
    });

    var securityProfileGroup1 = new Gcp.NetworkSecurity.SecurityProfileGroup("security_profile_group_1", new()
    {
        Name = "tf-security-profile-group",
        Parent = "organizations/123456789",
        Description = "my description",
        ThreatPreventionProfile = securityProfile1.Id,
    });

    var firewall_policy_with_rules = new Gcp.Compute.FirewallPolicyWithRules("firewall-policy-with-rules", new()
    {
        ShortName = "tf-fw-org-policy-with-rules",
        Description = "Terraform test",
        Parent = "organizations/123456789",
        Rules = new[]
        {
            new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
            {
                Description = "tcp rule",
                Priority = 1000,
                EnableLogging = true,
                Action = "allow",
                Direction = "EGRESS",
                Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
                {
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                                "7070",
                            },
                        },
                    },
                    DestIpRanges = new[]
                    {
                        "11.100.0.1/32",
                    },
                    DestFqdns = new[]
                    {
                        "www.yyy.com",
                        "www.zzz.com",
                    },
                    DestRegionCodes = new[]
                    {
                        "HK",
                        "IN",
                    },
                    DestThreatIntelligences = new[]
                    {
                        "iplist-search-engines-crawlers",
                        "iplist-tor-exit-nodes",
                    },
                    DestAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                },
                TargetResources = new[]
                {
                    $"https://www.googleapis.com/compute/beta/projects/{project.Apply(getProjectResult => getProjectResult.Name)}/global/networks/default",
                },
            },
            new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
            {
                Description = "udp rule",
                Priority = 2000,
                EnableLogging = false,
                Action = "deny",
                Direction = "INGRESS",
                Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
                {
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "udp",
                        },
                    },
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    SrcFqdns = new[]
                    {
                        "www.abc.com",
                        "www.def.com",
                    },
                    SrcRegionCodes = new[]
                    {
                        "US",
                        "CA",
                    },
                    SrcThreatIntelligences = new[]
                    {
                        "iplist-known-malicious-ips",
                        "iplist-public-clouds",
                    },
                    SrcAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                },
                Disabled = true,
            },
            new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
            {
                Description = "security profile group rule",
                RuleName = "tcp rule",
                Priority = 3000,
                EnableLogging = false,
                Action = "apply_security_profile_group",
                Direction = "INGRESS",
                Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
                {
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                        },
                    },
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                },
                TargetServiceAccounts = new[]
                {
                    "test@google.com",
                },
                SecurityProfileGroup = securityProfileGroup1.Id.Apply(id => $"//networksecurity.googleapis.com/{id}"),
                TlsInspect = true,
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.networksecurity.AddressGroup;
import com.pulumi.gcp.networksecurity.AddressGroupArgs;
import com.pulumi.gcp.networksecurity.SecurityProfile;
import com.pulumi.gcp.networksecurity.SecurityProfileArgs;
import com.pulumi.gcp.networksecurity.SecurityProfileGroup;
import com.pulumi.gcp.networksecurity.SecurityProfileGroupArgs;
import com.pulumi.gcp.compute.FirewallPolicyWithRules;
import com.pulumi.gcp.compute.FirewallPolicyWithRulesArgs;
import com.pulumi.gcp.compute.inputs.FirewallPolicyWithRulesRuleArgs;
import com.pulumi.gcp.compute.inputs.FirewallPolicyWithRulesRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject();

        var addressGroup1 = new AddressGroup("addressGroup1", AddressGroupArgs.builder()
            .name("tf-address-group")
            .parent("organizations/123456789")
            .description("Global address group")
            .location("global")
            .items("208.80.154.224/32")
            .type("IPV4")
            .capacity(100)
            .build());

        var securityProfile1 = new SecurityProfile("securityProfile1", SecurityProfileArgs.builder()
            .name("tf-security-profile")
            .type("THREAT_PREVENTION")
            .parent("organizations/123456789")
            .location("global")
            .build());

        var securityProfileGroup1 = new SecurityProfileGroup("securityProfileGroup1", SecurityProfileGroupArgs.builder()
            .name("tf-security-profile-group")
            .parent("organizations/123456789")
            .description("my description")
            .threatPreventionProfile(securityProfile1.id())
            .build());

        var firewall_policy_with_rules = new FirewallPolicyWithRules("firewall-policy-with-rules", FirewallPolicyWithRulesArgs.builder()
            .shortName("tf-fw-org-policy-with-rules")
            .description("Terraform test")
            .parent("organizations/123456789")
            .rules(            
                FirewallPolicyWithRulesRuleArgs.builder()
                    .description("tcp rule")
                    .priority(1000)
                    .enableLogging(true)
                    .action("allow")
                    .direction("EGRESS")
                    .match(FirewallPolicyWithRulesRuleMatchArgs.builder()
                        .layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(                            
                                8080,
                                7070)
                            .build())
                        .destIpRanges("11.100.0.1/32")
                        .destFqdns(                        
                            "www.yyy.com",
                            "www.zzz.com")
                        .destRegionCodes(                        
                            "HK",
                            "IN")
                        .destThreatIntelligences(                        
                            "iplist-search-engines-crawlers",
                            "iplist-tor-exit-nodes")
                        .destAddressGroups(addressGroup1.id())
                        .build())
                    .targetResources(String.format("https://www.googleapis.com/compute/beta/projects/%s/global/networks/default", project.applyValue(getProjectResult -> getProjectResult.name())))
                    .build(),
                FirewallPolicyWithRulesRuleArgs.builder()
                    .description("udp rule")
                    .priority(2000)
                    .enableLogging(false)
                    .action("deny")
                    .direction("INGRESS")
                    .match(FirewallPolicyWithRulesRuleMatchArgs.builder()
                        .layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("udp")
                            .build())
                        .srcIpRanges("0.0.0.0/0")
                        .srcFqdns(                        
                            "www.abc.com",
                            "www.def.com")
                        .srcRegionCodes(                        
                            "US",
                            "CA")
                        .srcThreatIntelligences(                        
                            "iplist-known-malicious-ips",
                            "iplist-public-clouds")
                        .srcAddressGroups(addressGroup1.id())
                        .build())
                    .disabled(true)
                    .build(),
                FirewallPolicyWithRulesRuleArgs.builder()
                    .description("security profile group rule")
                    .ruleName("tcp rule")
                    .priority(3000)
                    .enableLogging(false)
                    .action("apply_security_profile_group")
                    .direction("INGRESS")
                    .match(FirewallPolicyWithRulesRuleMatchArgs.builder()
                        .layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .build())
                        .srcIpRanges("0.0.0.0/0")
                        .build())
                    .targetServiceAccounts("test@google.com")
                    .securityProfileGroup(securityProfileGroup1.id().applyValue(id -> String.format("//networksecurity.googleapis.com/%s", id)))
                    .tlsInspect(true)
                    .build())
            .build());

    }
}

resources:
  firewall-policy-with-rules:
    type: gcp:compute:FirewallPolicyWithRules
    properties:
      shortName: tf-fw-org-policy-with-rules
      description: Terraform test
      parent: organizations/123456789
      rules:
        - description: tcp rule
          priority: 1000
          enableLogging: true
          action: allow
          direction: EGRESS
          match:
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
                  - 7070
            destIpRanges:
              - 11.100.0.1/32
            destFqdns:
              - www.yyy.com
              - www.zzz.com
            destRegionCodes:
              - HK
              - IN
            destThreatIntelligences:
              - iplist-search-engines-crawlers
              - iplist-tor-exit-nodes
            destAddressGroups:
              - ${addressGroup1.id}
          targetResources:
            - https://www.googleapis.com/compute/beta/projects/${project.name}/global/networks/default
        - description: udp rule
          priority: 2000
          enableLogging: false
          action: deny
          direction: INGRESS
          match:
            layer4Configs:
              - ipProtocol: udp
            srcIpRanges:
              - 0.0.0.0/0
            srcFqdns:
              - www.abc.com
              - www.def.com
            srcRegionCodes:
              - US
              - CA
            srcThreatIntelligences:
              - iplist-known-malicious-ips
              - iplist-public-clouds
            srcAddressGroups:
              - ${addressGroup1.id}
          disabled: true
        - description: security profile group rule
          ruleName: tcp rule
          priority: 3000
          enableLogging: false
          action: apply_security_profile_group
          direction: INGRESS
          match:
            layer4Configs:
              - ipProtocol: tcp
            srcIpRanges:
              - 0.0.0.0/0
          targetServiceAccounts:
            - test@google.com
          securityProfileGroup: //networksecurity.googleapis.com/${securityProfileGroup1.id}
          tlsInspect: true
  addressGroup1:
    type: gcp:networksecurity:AddressGroup
    name: address_group_1
    properties:
      name: tf-address-group
      parent: organizations/123456789
      description: Global address group
      location: global
      items:
        - 208.80.154.224/32
      type: IPV4
      capacity: 100
  securityProfileGroup1:
    type: gcp:networksecurity:SecurityProfileGroup
    name: security_profile_group_1
    properties:
      name: tf-security-profile-group
      parent: organizations/123456789
      description: my description
      threatPreventionProfile: ${securityProfile1.id}
  securityProfile1:
    type: gcp:networksecurity:SecurityProfile
    name: security_profile_1
    properties:
      name: tf-security-profile
      type: THREAT_PREVENTION
      parent: organizations/123456789
      location: global
variables:
  project:
    fn::invoke:
      Function: gcp:organizations:getProject
      Arguments: {}

var firewallPolicyWithRulesResource = new Gcp.Compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource", new()
{
    Parent = "string",
    Rules = new[]
    {
        new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
        {
            Action = "string",
            Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
            {
                Layer4Configs = new[]
                {
                    new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                    {
                        IpProtocol = "string",
                        Ports = new[]
                        {
                            "string",
                        },
                    },
                },
                DestAddressGroups = new[]
                {
                    "string",
                },
                DestFqdns = new[]
                {
                    "string",
                },
                DestIpRanges = new[]
                {
                    "string",
                },
                DestRegionCodes = new[]
                {
                    "string",
                },
                DestThreatIntelligences = new[]
                {
                    "string",
                },
                SrcAddressGroups = new[]
                {
                    "string",
                },
                SrcFqdns = new[]
                {
                    "string",
                },
                SrcIpRanges = new[]
                {
                    "string",
                },
                SrcRegionCodes = new[]
                {
                    "string",
                },
                SrcThreatIntelligences = new[]
                {
                    "string",
                },
            },
            Priority = 0,
            Description = "string",
            Direction = "string",
            Disabled = false,
            EnableLogging = false,
            RuleName = "string",
            SecurityProfileGroup = "string",
            TargetResources = new[]
            {
                "string",
            },
            TargetServiceAccounts = new[]
            {
                "string",
            },
            TlsInspect = false,
        },
    },
    ShortName = "string",
    Description = "string",
});

example, err := compute.NewFirewallPolicyWithRules(ctx, "firewallPolicyWithRulesResource", &compute.FirewallPolicyWithRulesArgs{
	Parent: pulumi.String("string"),
	Rules: compute.FirewallPolicyWithRulesRuleArray{
		&compute.FirewallPolicyWithRulesRuleArgs{
			Action: pulumi.String("string"),
			Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
				Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
					&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("string"),
						Ports: pulumi.StringArray{
							pulumi.String("string"),
						},
					},
				},
				DestAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
			Priority:             pulumi.Int(0),
			Description:          pulumi.String("string"),
			Direction:            pulumi.String("string"),
			Disabled:             pulumi.Bool(false),
			EnableLogging:        pulumi.Bool(false),
			RuleName:             pulumi.String("string"),
			SecurityProfileGroup: pulumi.String("string"),
			TargetResources: pulumi.StringArray{
				pulumi.String("string"),
			},
			TargetServiceAccounts: pulumi.StringArray{
				pulumi.String("string"),
			},
			TlsInspect: pulumi.Bool(false),
		},
	},
	ShortName:   pulumi.String("string"),
	Description: pulumi.String("string"),
})

var firewallPolicyWithRulesResource = new FirewallPolicyWithRules("firewallPolicyWithRulesResource", FirewallPolicyWithRulesArgs.builder()
    .parent("string")
    .rules(FirewallPolicyWithRulesRuleArgs.builder()
        .action("string")
        .match(FirewallPolicyWithRulesRuleMatchArgs.builder()
            .layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                .ipProtocol("string")
                .ports("string")
                .build())
            .destAddressGroups("string")
            .destFqdns("string")
            .destIpRanges("string")
            .destRegionCodes("string")
            .destThreatIntelligences("string")
            .srcAddressGroups("string")
            .srcFqdns("string")
            .srcIpRanges("string")
            .srcRegionCodes("string")
            .srcThreatIntelligences("string")
            .build())
        .priority(0)
        .description("string")
        .direction("string")
        .disabled(false)
        .enableLogging(false)
        .ruleName("string")
        .securityProfileGroup("string")
        .targetResources("string")
        .targetServiceAccounts("string")
        .tlsInspect(false)
        .build())
    .shortName("string")
    .description("string")
    .build());

firewall_policy_with_rules_resource = gcp.compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource",
    parent="string",
    rules=[{
        "action": "string",
        "match": {
            "layer4_configs": [{
                "ip_protocol": "string",
                "ports": ["string"],
            }],
            "dest_address_groups": ["string"],
            "dest_fqdns": ["string"],
            "dest_ip_ranges": ["string"],
            "dest_region_codes": ["string"],
            "dest_threat_intelligences": ["string"],
            "src_address_groups": ["string"],
            "src_fqdns": ["string"],
            "src_ip_ranges": ["string"],
            "src_region_codes": ["string"],
            "src_threat_intelligences": ["string"],
        },
        "priority": 0,
        "description": "string",
        "direction": "string",
        "disabled": False,
        "enable_logging": False,
        "rule_name": "string",
        "security_profile_group": "string",
        "target_resources": ["string"],
        "target_service_accounts": ["string"],
        "tls_inspect": False,
    }],
    short_name="string",
    description="string")

const firewallPolicyWithRulesResource = new gcp.compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource", {
    parent: "string",
    rules: [{
        action: "string",
        match: {
            layer4Configs: [{
                ipProtocol: "string",
                ports: ["string"],
            }],
            destAddressGroups: ["string"],
            destFqdns: ["string"],
            destIpRanges: ["string"],
            destRegionCodes: ["string"],
            destThreatIntelligences: ["string"],
            srcAddressGroups: ["string"],
            srcFqdns: ["string"],
            srcIpRanges: ["string"],
            srcRegionCodes: ["string"],
            srcThreatIntelligences: ["string"],
        },
        priority: 0,
        description: "string",
        direction: "string",
        disabled: false,
        enableLogging: false,
        ruleName: "string",
        securityProfileGroup: "string",
        targetResources: ["string"],
        targetServiceAccounts: ["string"],
        tlsInspect: false,
    }],
    shortName: "string",
    description: "string",
});

type: gcp:compute:FirewallPolicyWithRules
properties:
    description: string
    parent: string
    rules:
        - action: string
          description: string
          direction: string
          disabled: false
          enableLogging: false
          match:
            destAddressGroups:
                - string
            destFqdns:
                - string
            destIpRanges:
                - string
            destRegionCodes:
                - string
            destThreatIntelligences:
                - string
            layer4Configs:
                - ipProtocol: string
                  ports:
                    - string
            srcAddressGroups:
                - string
            srcFqdns:
                - string
            srcIpRanges:
                - string
            srcRegionCodes:
                - string
            srcThreatIntelligences:
                - string
          priority: 0
          ruleName: string
          securityProfileGroup: string
          targetResources:
            - string
          targetServiceAccounts:
            - string
          tlsInspect: false
    shortName: string